Lucene search

K
cve[email protected]CVE-2023-26512
HistoryJul 17, 2023 - 8:15 a.m.

CVE-2023-26512

2023-07-1708:15:09
CWE-502
web.nvd.nist.gov
43
cve-2023-26512
cwe-502
apache eventmesh
rabbitmq-connector plugin
remote code execution
nvd
security
vulnerability
patch
update
fix
master branch
project repo

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.4 High

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

76.1%

CWE-502 Deserialization of Untrusted Data at the rabbitmq-connector plugin module in Apache EventMesh (incubating) V1.7.0\V1.8.0 on windows\linux\mac os e.g. platforms allows attackers to send controlled message and

remote code execute via rabbitmq messages. Users can use the code under the master branch in project repo to fix this issue, we will release the new version as soon as possible.

Affected configurations

Vulners
NVD
Node
apacheeventmeshRange1.8.0

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache EventMesh (incubating) RabbitMQ connector",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "1.8.0",
        "status": "affected",
        "version": "1.7.0",
        "versionType": "maven"
      }
    ]
  }
]

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.4 High

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

76.1%

Related for CVE-2023-26512